Malicious Package

Overview @pmate/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@pmate/account-sdk (>=0.6.1, <=0.10.2), @pmate/agent-sdk (>=1.0.2, <=2.0.1) +3 more potentially affected by unknown CVE via @pmate/utils (1.1.4)

@pmate/utils NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @pmate/utils and may be impacted: - @pmate/account-sdk =0.6.1, =1.0.2, =0.1.3, =0.12.0, =0.2.0, =0.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-PMATEUTILS-18550696...

Malicious code in @pmate/utils (npm)

Source: amazon-inspector d918da5fdc17486ed55296e53c1de2f1d976895f77e33dc7f73991e36f393502 The exported detectTextimageBase64 function in src/detectText.ts sends caller-supplied image content to https://vision.googleapis.com/v1/images:annotate using a hardcoded Google Cloud API key...